https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T05:02:17.009593+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2026-33624 BIT-parse-2026-33624 — Parse Server: MFA recovery code single-use bypass via concurrent requests 2026-10-07T05:02:17.062548+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0, an attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0

 https://cve.radiocsirt.org/vuln/euvd-2026-277420 EUVD-2026-277420 2026-10-07T05:02:17.062608+00:00 EUVD-2026-277420 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33624 fkie_cve-2026-33624 2026-10-07T05:02:17.062626+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0-alpha.54.

 https://cve.radiocsirt.org/vuln/ghsa-2299-ghjr-6vjp GHSA-2299-ghjr-6vjp — Parse Server: MFA recovery code single-use bypass via concurrent requests 2026-10-07T05:02:17.062653+00:00

Affected: npm: parse-server

### Impact

An attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds.

### Patches

The login handler now uses optimistic locking when updating auth data that contains consumed single-use tokens. If a concurrent request has already modified the recovery array, the update fails and the login is rejected.

### Workarounds

There are no known workarounds.